ISO\IEC 27001:2022
Information Security

What is ISO\IEC 27001:2022?

The ISO\IEC 27001:2022 ISMS standard is broken up into two sections of Controls.

1. Management Controls which has a total of 148 controls.
2. Operational Controls which has a total of 113 Controls.

Controls are defined as applicable or not applicable, using the Statement of Applicability and the baseline risk assessment comprises of all applicable risks associated with the total of 261 controls of the ISO\IEC 27001:2013 standard. The Standard is defined in accordance with the Plan-Do-Check-Act cycle and risk methodology with a focus on 50 guideline standards that range from guidance on Cloud Security, Cybersecurity & Incident Management Security. The standard is focused on ensuring that the General Data Protection Regulation (GDPR) and Protection of Personal Information Act (POPIA) are also complied with.

Effective utilisation of Firewalls and it’s rules, Encryption Methodologies, Anti-virus Programs, Patch Management, Vulnerability Management, backup, Business Continuity and Disaster Recovery Plans and Asset Management are some of the key controls the standard focuses on. The organisation is to demonstrate the effective utilisation of tools to secure its respective networks that allow them access to information, and these are to be aligned to the standards and organisations policies.

Why does an Organisation need ISO\IEC 27001:2022?

As technology advances rapidly, data and information has become increasingly valuable to organisations. In order to protect information that may be confidential, ensure the confidentiality of personal and sensitive information, preserve the integrity of interested parties, and ensure and continuous availability of information

Any organisation that handles sensitive information, both from internal and external sources, should consider implementing the ISO 27001 standard as the standard promotes a risk and security awareness culture. It will assist in managing security incidents, compliance risks, and financial losses.

The standard provides organisations with the methodology to comply with the increasing legal requirements related to information security.

• Processes to ensure to preserve the confidentiality of information,
• It provides organisations with a framework for complying with information security, legal, contractual and other requirements,
• Provides interested parties with the confidence that information is well managed,
• Allowing for secure exchange of information,
• Assisting you to comply with other regulations (e.g., Sarbanes Oxley Act, Service Organization Control SOC 1 – Type 1 and 2, and SOC 2 – Type 1 and 2),
• Provides an organisation with a competitive advantage due to the certificate of conformance issued by a trusted and accredited certification body,
• Assists IT personnel with the correct Policies and Guidelines,
• Enhances customer satisfaction that improves client retention,
• Manages and minimises risk exposure,
• Builds a culture of security,
• Protects company, assets, shareholders, and directors, since management is committed to the security of the organisation, including customer information.

How do I implement ISO\IEC 27001:2022 in an organisation?

ISO Consulting & Implementation:

We have a range of professional consultants, engineers, and registered auditors to assist in implementing and maintaining any ISO management system. Our industry expertise includes services, telecommunication, manufacturing, construction, engineering services, fast-moving consumer goods, mining, power generation, state owned companies and government-run organisations. A good consultant takes the time to truly understand the processes of your company.

Therefore, they can approach the implementation of ISO requirements accordingly. The cost of hiring a consultant and the time spent to implement your ISO management system will definitely pay off in the long run.

WWISE has a 4-Phase Approach:

• Phase 1: Gap Analysis Audit and Information Gathering
• Phase 2: ISO Documentation, Risk Assessment, and Process Mapping
• Phase 3: Implementation and Coaching
• Phase 4: Certification

WWISE provides a turnkey solution which includes templates, 1-on-1 coaching, on-the-job training, and mentorship. As a consulting firm, we do not provide certification services. However, we will guide you through the certification process and ensure that your business gets certified.

Why Choose WWISE to assist your organisation?

An organisation can get certified to a requirement standard. You can implement the standard and get certified by a third party.